gelf_plugin_util.rb in fluent-plugin-gelf-best-1.2.0

- old
+ new
@@ -1,91 +1,80 @@
-# encoding=utf-8
 module Fluent
   module GelfPluginUtil
-
     require 'gelf'
 
-    def make_gelfentry(tag,time,record, conf = {})
-      gelfentry = { '_tag' => tag }
-      if defined? Fluent::EventTime and time.is_a? Fluent::EventTime then
-        gelfentry['timestamp'] = time.sec + (time.nsec.to_f/1000000000).round(3)
+    LEVEL_MAP = {
+      "0" => GELF::UNKNOWN, "1" => GELF::UNKNOWN, "a" => GELF::UNKNOWN,
+      "2" => GELF::FATAL, "c" => GELF::FATAL,
+      "3" => GELF::ERROR,
+      "4" => GELF::WARN, "w" => GELF::WARN,
+      "5" => GELF::INFO, "n" => GELF::INFO,
+      "6" => GELF::INFO, "i" => GELF::INFO,
+      "7" => GELF::DEBUG, "d" => GELF::DEBUG,
+      "e" => GELF::ERROR  # assuming 'e' stands typically for 'error'
+    }
+
+    def make_gelfentry(tag, time, record, conf = {})
+      gelfentry = {"_fluentd_tag" => tag}
+      gelfentry["timestamp"] = calculate_timestamp(time)
+
+      record.each_pair do |k, v|
+        gelfentry.merge!(process_record_entry(k, v, conf, gelfentry))
+      end
+
+      ensure_short_message(gelfentry)
+      gelfentry.compact
+    end
+
+    private
+
+    def calculate_timestamp(time)
+      if defined?(Fluent::EventTime) && time.is_a?(Fluent::EventTime)
+        time.sec + (time.nsec.to_f / 1_000_000_000).round(3)
       else
-        gelfentry['timestamp'] = time
+        time
       end
+    end
 
-      record.each_pair do |k,v|
-        case k
-        when 'host' then
-          if conf[:use_record_host] then
-            gelfentry['host'] = v
-          else
-            gelfentry['_host'] = v
-          end
-        when 'level' then
-          case v.to_s.downcase[0]
-          # emergency and alert aren't supported by gelf-rb
-          when "0" then
-            gelfentry['level'] = GELF::UNKNOWN
-          when "1", "a" then
-            gelfentry['level'] = GELF::UNKNOWN
-          when "2", "c" then
-            gelfentry['level'] = GELF::FATAL
-          when "3" then
-            gelfentry['level'] = GELF::ERROR
-          when "4", "w" then
-            gelfentry['level'] = GELF::WARN
-          # gelf-rb also skips notice
-          when "5", "n" then
-            gelfentry['level'] = GELF::INFO
-          when "6", "i" then
-            gelfentry['level'] = GELF::INFO
-          when "7", "d" then
-            gelfentry['level'] = GELF::DEBUG
-          when "e" then
-            if v.to_s.length >= 2 and v.to_s.downcase[1] != "r" then
-              gelfentry['level'] = GELF::UNKNOWN
-            else
-              gelfentry['level'] = GELF::ERROR
-            end
-          else
-            gelfentry['_level'] = v
-          end
-        when 'msec' then
-          # msec must be three digits (leading/trailing zeroes)
-          if conf[:add_msec_time] then
-            gelfentry['timestamp'] = "#{time.to_s}.#{v}".to_f
-          else
-            gelfentry['_msec'] = v
-          end
-        when 'short_message', 'full_message', 'facility', 'line', 'file' then
-          gelfentry[k] = v
-        else
-          if !k.start_with?('_')
-            gelfentry['_'+k] = v
-          else
-            gelfentry[k] = v
-          end
+    def process_record_entry(k, v, conf, gelfentry)
+      case k
+      when 'host', 'hostname'
+        return {'host' => (conf[:use_record_host] ? v : gelfentry['_host'] = v)}
+      when 'timestamp', 'time'
+        { 'timestamp' => parse_timestamp(v) }
+      when 'level'
+        {'level' => LEVEL_MAP[v.to_s.downcase[0]] || (v.to_s.length >= 2 && v.to_s.downcase[1] != "r" ? GELF::UNKNOWN : v)}
+      when 'msec'
+        conf[:add_msec_time] ? {'timestamp' => "#{time.to_s}.#{v}".to_f} : {'_msec' => v}
+      when 'short_message', 'version', 'full_message', 'facility', 'file', 'line'
+        {k => v}
+      else
+        {k.start_with?('_') ? k : "_#{k}" => v}
+      end
+    end
+
+    def parse_timestamp(v)
+      if v.is_a?(Integer) || v.is_a?(Float)
+        v
+      else
+        begin
+          (DateTime.parse(v).strftime("%Q").to_f / 1_000).round(3)
+        rescue ArgumentError
+          v
         end
       end
+    end
 
-      if !gelfentry.key?('short_message') or gelfentry['short_message'].to_s.strip.empty? then
-        # allow other non-empty fields to masquerade as the short_message if it is unset
-        if gelfentry.key?('_message') and !gelfentry['_message'].to_s.strip.empty? then
-          gelfentry['short_message'] = gelfentry.delete('_message')
-        elsif gelfentry.key?('_msg') and !gelfentry['_msg'].to_s.strip.empty? then
-          gelfentry['short_message'] = gelfentry.delete('_msg')
-        elsif gelfentry.key?('_log') and !gelfentry['_log'].to_s.strip.empty? then
-          gelfentry['short_message'] = gelfentry.delete('_log')
-        elsif gelfentry.key?('_record') and !gelfentry['_record'].to_s.strip.empty? then
-          gelfentry['short_message'] = gelfentry.delete('_record')
-        else
-          # we must have a short_message, so provide placeholder
-          gelfentry['short_message'] = '(no message)'
+    def ensure_short_message(gelfentry)
+      return if gelfentry['short_message'] && !gelfentry['short_message'].to_s.strip.empty?
+
+      ['_message', '_msg', '_log', '_record'].each do |key|
+        if gelfentry[key] && !gelfentry[key].to_s.strip.empty?
+          gelfentry['short_message'] = gelfentry.delete(key)
+          return
         end
       end
 
-      # I realize the nulls are will be treated as unset keys, but it does
-      # tend to make for larger files and data transmissions.
-      return gelfentry.delete_if{ |k,v| v.nil? }
+      gelfentry['short_message'] = '(no message)' unless gelfentry['short_message']
     end
   end
 end